Trojan.Siggen31.38366

Technical Information

Malicious functions

To complicate detection of its presence in the operating system,

modifies the following system settings:

DNS server to '<DNS_SERVER>'

Sets a new unauthorized home page for Windows Internet Explorer.

Modifies file system

Creates the following files

%TEMP%\12de3d.tmp
%TEMP%\12e0ce.tmp
%TEMP%\12e293.tmp
%WINDIR%\syswow64\shan.bat
<Current directory>\updata.bat
<Current directory>\v9fx.mir
%TEMP%\130740.tmp
%TEMP%\1308f6.tmp
%TEMP%\130a00.tmp
%TEMP%\etilqs_bzrpxam7th6lpbm
%TEMP%\etilqs_3jlgcpfjpbhssdu
%TEMP%\etilqs_exjvwkclusao8hf
%TEMP%\etilqs_shratuzy34hmpzy
%TEMP%\etilqs_eootfjpfl85xu42
%TEMP%\etilqs_nmrljmpevgxvmla
%TEMP%\etilqs_1qbgnm6bjrrbvwm
%TEMP%\etilqs_hw2dwmtsicn8ilg
%TEMP%\etilqs_y5atswtmoumjefu
%TEMP%\etilqs_ikzvtzlgttvuvbs

Sets the 'hidden' attribute to the following files

<Current directory>\updata.bat

Deletes the following files

%TEMP%\12de3d.tmp
%TEMP%\12e0ce.tmp
%TEMP%\12e293.tmp
<DRIVERS>\etc\hosts
<Current directory>\updata.bat
%TEMP%\130740.tmp
%TEMP%\1308f6.tmp
%TEMP%\130a00.tmp
<Current directory>\v9fx.mir

Substitutes the following files

<Current directory>\updata.bat

Network activity

Connects to

'localhost':80
'au######te.geo.opera.com':80
'au######te.geo.opera.com':443
'google.com':80
'se####.yahoo.com':80
'du###uckgo.com':443
'am##on.com':80
'bing.com':80
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':80
'en.###ipedia.org':443
'si#####ck2.opera.com':80
're###.opera.com':80
'x1.#.lencr.org':80
'ya###.opera.com':80
'fa###ook.com':80
'bl#####st.rkn.gov.ru':80
'bl#####st.rkn.gov.ru':443

TCP

HTTP GET requests

http://au######te.geo.opera.com/geolocation/
http://www.google.com/favicon.ico
http://se####.yahoo.com/favicon.ico
http://www.am##on.com/favicon.ico
http://www.bing.com/s/a/bing_p.ico
http://en.###ipedia.org/favicon.ico
http://si#####ck2.opera.com/?ho###################################################
http://re###.opera.com/www.opera.com/firstrun/
http://x1.#.lencr.org/
http://si#####ck2.opera.com/?ho######################################################
http://re###.opera.com/favicon.ico
http://ya###.opera.com/favicon.ico
http://re###.opera.com/speeddials/partner/facebook
http://www.fa###ook.com/campaign/landing.php?ca#########################
http://bl#####st.rkn.gov.ru/
http://bl#####st.rkn.gov.ru/DDoS01/104dd3b8/

Other

'<DNS_SERVER>':53
'au######te.geo.opera.com':443
'du###uckgo.com':443
'am##on.com':443
'se####.yahoo.com':443
'en.###ipedia.org':443
'ya###.opera.com':443
'bl#####st.rkn.gov.ru':443

UDP

DNS ASK 1.######heng.sinaapp.com
DNS ASK 52##zu.com
DNS ASK microsoft.com
DNS ASK google.com
DNS ASK au######te.geo.opera.com
DNS ASK se####.yahoo.com
DNS ASK du###uckgo.com
DNS ASK am##on.com
DNS ASK bing.com
DNS ASK bi##.#ikimedia.org
DNS ASK en.###ipedia.org
DNS ASK si#####ck2.opera.com
DNS ASK re###.opera.com
DNS ASK x1.#.lencr.org
DNS ASK ya###.opera.com
DNS ASK op##a.com
DNS ASK fa###ook.com
DNS ASK bl#####st.rkn.gov.ru

Miscellaneous

Searches for the following windows

ClassName: 'Opera_MessageWindow' WindowName: '%APPDATA%\Opera Software\Opera Stable'

Creates and executes the following

'<Current directory>\v9fx.mir'

Executes the following

'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\shan.bat
'%WINDIR%\syswow64\cmd.exe' /c ipconfig |findstr /r "▒╛"
'%WINDIR%\syswow64\ipconfig.exe'
'%WINDIR%\syswow64\findstr.exe' /r "▒╛"
'%WINDIR%\syswow64\netsh.exe' interface ip set dns name="" source=static addr=11#.#14.114.114
'%WINDIR%\syswow64\netsh.exe' interface ip add dns "" 8.#.8.8 index=2
'%WINDIR%\syswow64\icacls.exe' <DRIVERS>\etc /t /grant:r everyone:f
'%WINDIR%\syswow64\cmd.exe' /c <Current directory>\updata.bat
'%WINDIR%\syswow64\icacls.exe' <DRIVERS>\etc\hosts /t /grant:r everyone:f
'%WINDIR%\syswow64\icacls.exe' <DRIVERS>\etc\hosts.ics /t /grant:r everyone:f
'%WINDIR%\syswow64\cmd.exe' /S /D /c" echo y"
'%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc /g everyone:f
'%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts /g everyone:f
'%WINDIR%\syswow64\cacls.exe' <DRIVERS>\etc\hosts.ics /g everyone:f
'%WINDIR%\syswow64\attrib.exe' <DRIVERS>\etc\hosts.ics -h -r
'%WINDIR%\syswow64\attrib.exe' <DRIVERS>\etc\hosts -h -r
'%ProgramFiles(x86)%\opera\launcher.exe' -noautoupdate -- "http://www1.sopojie.com/"
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' -noautoupdate --ran-launcher -- http://www1.sopojie.com/
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' -noautoupdate --ran-launcher -- http://www1.sopojie.com/ /crash-reporter-parent-id=1968
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=gpu-process --channel="1968.0.462987558\167619663" --enable-proprietary-media-types-playback --supports-dual-gpus=false --gpu-driver-bug-workarounds=1,19,42 --gpu-vendor-id=0x0000 --gpu-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --disable-client-side-phishing-...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=renderer --alt-high-dpi-setting=96 --disable-direct-npapi-requests --enable-deferred-image-decoding --lang=en-US --enable-proprietary-media-types-playback --extension-process --enable-we...
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.4.813340187\1040501960" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera_crashreporter.exe' --type=utility --channel="1968.4.813340187\1040501960" --lang=en-US --no-sandbox --enable-proprietary-media-types-playback /prefetch:-645351001 /crash-reporter-parent-id=1740
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.5.697941793\935418099" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.6.1444330129\798316006" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.7.1760277101\1784047523" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.8.1422199667\1535171666" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.9.1506464233\227470550" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.10.906684057\314949327" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.11.2121712211\223091056" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.12.1130268449\956494528" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.15.325268201\1026391636" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%ProgramFiles(x86)%\opera\29.0.1795.47\opera.exe' --type=utility --channel="1968.16.808550660\1431263418" --lang=en-US --enable-proprietary-media-types-playback --ignored=" --type=renderer " /prefetch:-645351001
'%WINDIR%\syswow64\cmd.exe' /c <SYSTEM32>\shan.bat' (with hidden window)
'%WINDIR%\syswow64\cmd.exe' /c <Current directory>\updata.bat' (with hidden window)

技术

术语

教育培训

误区

Technical Information

Curing recommendations

Free trial